Sophos Central MCP Server

MCP (Model Context Protocol) server for interacting with Sophos Central APIs. Supports partner, organisation, and single-tenant credential types with automatic region routing. 255 tools covering 14 Sophos API namespaces.

Quick Start

Claude Desktop

No installation needed. Open your claude_desktop_config.json (File > Settings > Developer > Edit Config) and add the sophos-central block inside mcpServers:

macOS / Linux:

{
  "mcpServers": {
    "sophos-central": {
      "command": "npx",
      "args": ["-y", "sophos-central-mcp-server"],
      "env": {
        "SOPHOS_CLIENT_ID": "your-client-id",
        "SOPHOS_CLIENT_SECRET": "your-client-secret",
        "TRANSPORT": "stdio"
      }
    }
  }
}

Windows:

{
  "mcpServers": {
    "sophos-central": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "sophos-central-mcp-server"],
      "env": {
        "SOPHOS_CLIENT_ID": "your-client-id",
        "SOPHOS_CLIENT_SECRET": "your-client-secret",
        "TRANSPORT": "stdio"
      }
    }
  }
}

If you already have other MCP servers configured, don't replace the whole file — just add the "sophos-central": { ... } entry alongside your existing servers inside the "mcpServers" object.

Replace your-client-id and your-client-secret with your Sophos Central API credentials. Restart Claude Desktop after saving — it will download and run the server automatically on first use.

Claude Code

Run this once in your terminal. The -e flags save the credentials permanently to Claude Code's MCP config so you don't need to re-export them each session:

macOS / Linux:

claude mcp add sophos-central \
  -e SOPHOS_CLIENT_ID="your-client-id" \
  -e SOPHOS_CLIENT_SECRET="your-client-secret" \
  -e TRANSPORT="stdio" \
  -- npx -y sophos-central-mcp-server

Windows (Command Prompt):

claude mcp add sophos-central ^
  -e SOPHOS_CLIENT_ID="your-client-id" ^
  -e SOPHOS_CLIENT_SECRET="your-client-secret" ^
  -e TRANSPORT="stdio" ^
  -- cmd /c npx -y sophos-central-mcp-server

Features

• Universal caller support: Works with partner, organisation, and tenant-level API credentials
• Multi-tenant: Partner/org callers can query across all managed tenants
• Partner gap analysis: Single-call sales opportunity report across all managed tenants — fetches health data in parallel and returns a compact ranked list of security gaps per customer
• Auto region routing: Discovers tenant data regions via /whoami/v1 and routes requests to the correct regional API host
• Token lifecycle: Automatic OAuth2 token refresh before expiry
• Rate limit handling: Retry with backoff on 429 responses
• Dual transport: Streamable HTTP (for Claude Desktop / Claude Code) or stdio
• Full API coverage: 255 tools across endpoints, alerts, policies, firewalls, email, mobile, XDR, cases, SIEM, and more

Screenshots

Querying tenants and drilling into endpoint status:

Tenant listing and endpoint staleness check

Tenant health audit with full category breakdown:

Tenant health overview

Tenant health detail and endpoints

Prerequisites

• Node.js 20 or later
• Sophos Central API credentials (Client ID + Client Secret)

Creating API Credentials

Tenant-level: In Sophos Central, go to Settings > API Credentials Management and create a new credential.

Partner-level: In the Sophos Partner Dashboard, create API credentials under Settings > API Credentials.

Organisation-level: In Sophos Central Enterprise, use Global Settings > API Credentials Management.

Configuration

Copy .env.example to .env and set your credentials:

SOPHOS_CLIENT_ID=your-client-id
SOPHOS_CLIENT_SECRET=your-client-secret
PORT=3100
TRANSPORT=http

Tools

Partner & Organisation (18 tools)

These tools are only available with partner or organisation-level credentials. They operate across all managed tenants.

Alerts (4 tools)

Endpoints (18 tools)

Endpoint Settings (30 tools)

Endpoint Migrations (7 tools)

Policies (6 tools)

Endpoint Groups (7 tools)

Exclusions & Allow/Block Lists (9 tools)

Account Health (3 tools)

Directory Users & Groups (17 tools)

Admin Management (13 tools)

Cases (9 tools)

Detections (6 tools)

Async API — start a query, poll for completion, then fetch results.

SIEM (2 tools)

XDR Data Lake (9 tools)

Async API — submit SQL queries against historical telemetry.

Live Discover (4 tools)

Async API — run OSquery SQL on live endpoints. Rate limited to 10 runs/minute, 500/day.

Firewall (19 tools)

Email Protection (29 tools)

Mobile Device Management (32 tools)

DNS Protection (5 tools)

Cloud Security (5 tools)

Wi-Fi (3 tools)

User Activity (2 tools)

Tenant context

For partner/org callers, every tenant-scoped tool requires a tenant_id parameter. Use sophos_list_tenants first to discover available tenant IDs.

For tenant-level callers, tenant_id is optional and defaults to the authenticated tenant.

Architecture

Authenticate (OAuth2 client credentials)
    |
    v
/whoami/v1 -> Discover identity type (partner | organization | tenant)
    |
    v
If partner/org: enumerate tenants, cache {tenantId -> apiHost}
    |
    v
Register tools based on identity type
    |
    v
Per tool call: resolve tenant -> regional API host -> execute request

Key decisions

• Dynamic tool registration: Only tools valid for the caller type are exposed to the LLM
• Explicit tenant context: Partner/org callers must specify tenant_id to prevent cross-tenant accidents
• Stateless HTTP: Each MCP request creates a fresh transport instance (no session affinity)
• Localhost binding: HTTP server binds to 127.0.0.1 only

Project Structure

src/
├── index.ts                     # Entry point, server bootstrap
├── config/config.ts             # Environment config
├── auth/token-manager.ts        # OAuth2 token lifecycle
├── client/
│   ├── sophos-client.ts         # HTTP client with region routing
│   └── tenant-resolver.ts       # Whoami + tenant cache
├── tools/
│   ├── helpers.ts               # Shared response formatting
│   ├── tenants.ts               # Tenant listing (partner/org only)
│   ├── partner.ts               # Partner admin, roles, billing (partner/org only)
│   ├── alerts.ts                # Alert list, get, acknowledge, search
│   ├── endpoints.ts             # Endpoint CRUD, scan, isolate, tamper, forensics
│   ├── endpoint-settings.ts     # Installer, web control, exploit mitigation, IPS, etc.
│   ├── endpoint-migrations.ts   # Migration jobs, software packages
│   ├── health.ts                # Account health, gap analysis
│   ├── directory.ts             # Users, user groups, group membership
│   ├── admin-management.ts      # Admin CRUD, roles, permission sets
│   ├── policies.ts              # Policy CRUD, clone
│   ├── groups.ts                # Endpoint group CRUD, membership
│   ├── exclusions.ts            # Scanning exclusions, allowed/blocked items
│   ├── cases.ts                 # Investigation cases, detections, MITRE
│   ├── detections.ts            # Detection queries (async)
│   ├── siem.ts                  # SIEM events and alerts
│   ├── xdr.ts                   # XDR Data Lake queries (async)
│   ├── live-discover.ts         # Live Discover queries (async)
│   ├── firewall.ts              # Firewall CRUD, firmware, groups, threat feed
│   ├── email.ts                 # Quarantine, mailboxes, message actions
│   ├── mobile.ts                # Mobile devices, groups, actions, policies
│   ├── dns-protection.ts        # DNS locations
│   ├── cloud-security.ts        # Cloud security profiles, assets
│   ├── wifi.ts                  # Wi-Fi MAC filtering
│   └── user-activity.ts         # User attestations
└── types/sophos.ts              # Sophos API response types

Security

• Credentials are read from environment variables only, never logged
• JWT tokens are held in memory with automatic refresh
• HTTP server binds to 127.0.0.1 (localhost only)
• Write actions have destructiveHint annotations so clients can warn users
• Partner/org callers require explicit tenant_id on every call

License

MIT